8282134: Certain regex can cause a JS trap in WebView

arapte · arapte · commit 350fb53261e2 · 2022-04-29T17:59:28.000Z
Backport-of: 7396396
diff --git a/modules/javafx.web/src/main/native/Source/JavaScriptCore/yarr/YarrJIT.cpp b/modules/javafx.web/src/main/native/Source/JavaScriptCore/yarr/YarrJIT.cpp
@@ -2135,7 +2135,7 @@ class YarrGenerator final : public YarrJITInfo, private MacroAssembler {
 
         if (!nonGreedyFailuresDecrementIndex.empty()) {
             nonGreedyFailuresDecrementIndex.link(this);
-            breakpoint();
+            sub32(TrustedImm32(1), index);
         }
         nonGreedyFailures.link(this);
         sub32(countRegister, index);
diff --git a/modules/javafx.web/src/test/java/test/javafx/scene/web/LoadTest.java b/modules/javafx.web/src/test/java/test/javafx/scene/web/LoadTest.java
@@ -423,4 +423,12 @@ public void onError() {
             throw new AssertionError(ex);
         }
     }
+
+    // JDK-8282134 Certain regex can cause a JS trap in WebView
+    @Test public void jsRegexpTrapTest() {
+        final String FILE = "src/test/resources/test/html/unicode.html";
+        load(new File(FILE));
+        WebEngine web = getEngine();
+        assertTrue("Load task completed successfully", getLoadState() == SUCCEEDED);
+    }
 }
diff --git a/modules/javafx.web/src/test/resources/test/html/unicode.html b/modules/javafx.web/src/test/resources/test/html/unicode.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script>
+    let a = "\ud800\ud800\udc00"
+    let b = /(.*[^x]+?)[^]*([1])/u
+    b.exec(a)
+</script>
+
+<p id="regtest">PASS</p>
+
+</body>
+</html>

Original file line number	Diff line number	Diff line change
`@@ -2135,7 +2135,7 @@ class YarrGenerator final : public YarrJITInfo, private MacroAssembler {`
`2135`	`2135`
`2136`	`2136`	`if (!nonGreedyFailuresDecrementIndex.empty()) {`
`2137`	`2137`	`nonGreedyFailuresDecrementIndex.link(this);`
`2138`		`- breakpoint();`
	`2138`	`+ sub32(TrustedImm32(1), index);`
`2139`	`2139`	`}`
`2140`	`2140`	`nonGreedyFailures.link(this);`
`2141`	`2141`	`sub32(countRegister, index);`
Original file line number	Diff line number	Diff line change
`@@ -423,4 +423,12 @@ public void onError() {`
`423`	`423`	`throw new AssertionError(ex);`
`424`	`424`	`}`
`425`	`425`	`}`
	`426`	`+`
	`427`	`+ // JDK-8282134 Certain regex can cause a JS trap in WebView`
	`428`	`+ @Test public void jsRegexpTrapTest() {`
	`429`	`+ final String FILE = "src/test/resources/test/html/unicode.html";`
	`430`	`+ load(new File(FILE));`
	`431`	`+ WebEngine web = getEngine();`
	`432`	`+ assertTrue("Load task completed successfully", getLoadState() == SUCCEEDED);`
	`433`	`+ }`
`426`	`434`	`}`